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2008  Annual  Update 
to  the  Water  Sector-Specific  Plan 


Introduction 

This  report  provides  an  update  to  the  Water  Critical  Infrastructure  and  Key  Resources  (CIKR) 
Sector-Specific  Plan  (SSP)1,  as  input  to  the  National  Infrastructure  Protection  Plan  (NIPP)2.  This 
update,  based  on  guidance  issued  by  the  U.S.  Department  of  Homeland  Security  (DHS), 
provides  a  summary  of  advances  in  the  processes  set  out  in  the  SSP  and  the  achievement  of 
milestones.  It  is  intended  to  inform  Water  Sector  partners,  stakeholders,  and  Federal,  State, 
local  governments,  tribes,  and  other  interested  parties  about  updates  to  key  CIKR  protection 
efforts  in  the  Water  Sector.  The  U.S.  Environmental  Protection  Agency  (EPA)  prepared  this 
update  in  collaboration  with  the  Water  Sector  Coordinating  Council  (WSCC)  and  the 
Government  Coordinating  Council  (GCC),  two  critical  vehicles  that  were  established  under  the 
NIPP  to  provide  a  focal  point  of  interaction  respectively  with  the  water  industry  and  other 
Federal  and  State  partners. 

The  Water  SSP  provides  an  overview  of  the  Water  Sector  and  describes  the  vision  statement 
and  four  goals  for  the  Sector  (see  Table  1).  In  addition,  it  describes  the  protective  programs, 
measures,  and  research  and  development  ongoing  in  the  sector.  Since  the  Water  SSP  was 
published  in  May  2007,  the  Water  Sector  has  continued  to  enhance  CIKR  protection  from  all 
hazards.  This  SSP  update  addresses  several  of  the  key  activities  that  have  been  underway 
since  that  time,  and  is  organized  to  be  used  as  a  cross  reference  to  the  SSP  (see  Table  2).  As 
shown  in  Table  2,  SSP  Sections  5  and  6  are  being  updated.  This  update  is  not  intended  to 
address  every  change  within  the  Water  Sector  since  May  2007,  but  rather  to  highlight  key 
efforts.  In  accordance  with  the  NIPP,  the  Water  Sector  will  evaluate  the  status  of  the  SSP  on  an 
annual  basis. 


Table  1.  Water  Sector  Security  Vision  Statement  and  Security  Goals 


Water  Sector  Security  Vision 
Statement 

The  Water  Sector’s  Security  Vision  is  a  secure  and  resilient  drinking 
water  and  wastewater  infrastructure  that  provides  clean  and  safe 
water  as  an  integral  part  of  daily  life.  This  Vision  assures  the 
economic  vitality  of  and  public  confidence  in  the  Nation’s  drinking 
water  and  wastewater  through  a  layered  defense  of  effective 
preparedness  and  security  practices  in  the  sector. 

Sector  Goal 

Goal  1 

Sustain  protection  of  public  health  and  the  environment 

Goal  2 

Recognize  and  reduce  risks  in  the  Water  Sector 

Goal  3 

Maintain  a  resilient  infrastructure 

Goal  4 

Increase  communication,  outreach,  and  public  confidence 

Source:  SSP  for  the  Water  Sector.  May  2007 


1  U.S.  DHS  and  U.S.  EPA.  Water  Critical  Infrastructure  and  Key  Resources  Sector-Specific  Plan  as  input 
to  the  National  Infrastructure  Protection  Plan.  May  2007. 

(http://www.epa.gov/safewater/watersecurity/pubs/plan_security_watersectorspecificplan.pdf) 

2  U.S.  DHS.  National  Infrastructure  Protection  Plan.  2006. 
http://www.dhs.gov/xprevprot/programs/editorial_0827.shtm 
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Table  2.  Cross  Reference  of  Updates  to  May  2007  SSP 


SSP  Section 

SSP  Update 

1 .  Sector  Profile  and  Goals 

No  Update 

2.  Identify  Assets,  Systems,  Networks,  and 
Functions 

No  Update 

3.  Assess  Risks 

See  Section  5,  Goal  2  for  updates  on  risk 
assessment  methodologies 

4.  Prioritize  Infrastructure 

No  Update 

5.  Implementing  Protective  Programs 

Updates  provided  for  key  efforts  under  each  of 
the  four  SSP  goals 

6.  Measure  Progress 

Update  provided  for  sector-specific  metrics 

7.  CIKR  Protection  Research  and  Development 

No  Update 

8.  Managing  and  Coordinating  SSA 

Responsibilities 

No  Update 

To  prepare  the  sector  for  a  secure  future,  the  WSCC  is  setting  an  actionable  path  forward  that 
addresses  critical  needs  and  gaps.  Their  commitment  has  helped  to  launch  a  strategic  planning 
effort  that  will  improve  how  limited  resources  are  allocated  to  maximize  benefits  for  utility 
members.  In  particular,  the  WSCC  seeks  to  identify  and  document  the  "bottom  line"  security 
needs  of  Water  Sector  utilities  and  use  this  information  to  guide  efforts  that  can  deliver  those 
needs  or  remove  obstacles  to  satisfying  those  needs. 

The  WSCC  identified  key  trends,  drivers,  and  high-level  security  needs  of  the  Water  Sector 
during  a  WSCC  Strategic  Planning  Session  held  February  12,  2008  in  Washington,  DC.  To 
develop  a  more  comprehensive  plan,  the  WSCC  conducted  a  second  workshop  on  May  13, 
2008.  The  workshop  was  designed  to  identify  the  challenges  to  achieving  the  SSP  goals  and 
objectives  and  determine  the  most  urgent  security  needs  of  the  sector.  The  WSCC  is  currently 
finalizing  a  report  of  the  May  13  meeting  which  will  lay  out  the  key  challenges,  needs,  and 
priority  activities  identified  and  discussed  by  session  participants. 
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Update  to  Section  5  -  Implementing  Protective  Programs 

5.1.2  Description  of  Example  Protective  Programs 

The  Water  Sector’s  goals  and  objectives  provide  the  framework  to  develop  and  implement 
protective  programs  that  help  to  realize  a  more  secure  and  resilient  sector  against  all  hazards. 
The  Water  Sector  has  identified  strategic  goals  for  improving  its  security  posture.  During  this 
review/update,  we  have  identified  the  following  new  or  changes  to  existing  programs/protection 
efforts  to  ensure  our  sector  meets  these  goals. 

Goal  1 :  Sustain  Protection  of  Public  Health  and  the  Environment 


Water  Security  Initiative 

In  response  to  Goal  1  and  to  Homeland  Security  Presidential  Directive  9  (HSPD-9),  the  EPA 
initiated  its  Water  Security  Initiative  in  Fiscal  Year  (FY)  2006.  The  overall  goal  of  this  initiative  is 
to  design  and  demonstrate  an  effective  contamination  warning  system  for  timely  detection  and 
appropriate  response  to  drinking  water  contamination  threats  and  incidents  that  will  have  broad 
application  to  the  nation’s  drinking  water  utilities. 

The  first  Water  Security  Initiative  pilot  was  initiated  in  FY2006.  The  full  deployment  of  the 
monitoring  and  surveillance  equipment  and  development  of  a  consequence  management  plan 
for  this  pilot  were  completed  in  July  2007.  A  draft  plan  to  evaluate  the  operation,  performance, 
and  sustainability  of  the  pilot  is  under  development  in  conjunction  with  stakeholders.  EPA 
intends  to  deploy  up  to  four  additional  drinking  water  contamination  warning  system  pilots 
through  cooperative  agreements  with  local  governments.  EPA  initiated  deployment  of  the  2nd 
and  3rd  pilots  in  spring  2008,  and  work  on  the  4th  and  5th  pilots  is  expected  to  begin  in  fall  2008. 
FY  2009-201 1  will  entail  deploying,  calibrating,  and  operating  the  pilot  contaminant  warning 
systems,  as  well  as  conducting  thorough  evaluations  of  each  pilot.  EPA  will  then  issue  practical 
guidance  and  conduct  outreach  to  promote  voluntary  national  adoption  of  effective  and 
sustainable  drinking  water  contamination  warning  systems. 

The  EPA  published  an  interim  guidance  document  in  May  2007,  which  is  intended  to  assist 
water  utilities  with  implementing  a  contamination  warning  system,  including  site  assessment, 
system  engineering,  component  design,  consequence  management,  communications,  and  data 
management3.  Further,  the  EPA  has  drafted  two  additional  interim  guidance  documents  that  are 
currently  undergoing  stakeholder  review.  Interim  Guidance  on  Developing  an  Operational 
Strategy  will  assist  water  utilities  with  defining  routine  operational  procedures  for  the  monitoring 
and  surveillance  components  of  a  contamination  warning  system;  Interim  Guidance  on 
Developing  a  Consequence  Management  Plan  will  assist  water  utilities  with  establishing  a 
detailed  plan  for  responding  to  possible  contamination  events.  The  Agency  anticipates 
publishing  both  of  these  documents  in  the  summer  of  2008.  In  addition  to  guidance  documents, 
the  Agency  has  been  conducting  outreach  to  educate  drinking  water  stakeholders  about  the 
Water  Security  Initiative. 


3  U.S.  EPA.  Water  Security  Initiative:  Interim  Guidance  on  Planning  for  Contamination  Warning  System 
Deployment.  EPA-817-R-07-002.  May  2007. 

http://www.epa.gov/safewater/watersecurity/pubs/guide_watersecurity_securityinitiative_interimplanningp 

df.pdf 
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Water  Laboratory  Alliance 

The  EPA  will  address  an  additional  requirement  under  HSPD-9  to  enhance  the  security  of 
drinking  water  utilities  through  development  of  a  laboratory  network,  known  as  the  Water 
Laboratory  Alliance  (WLA).  The  purpose  of  the  WLA  is  to  provide  the  Water  Sector  with  an 
integrated  nationwide  network  of  laboratories  with  the  analytical  capabilities  and  capacity  to 
support  monitoring  and  surveillance,  response,  and  remediation.  The  EPA  is  working  to 
establish  a  nationwide  network  of  Federal,  State,  local,  and  commercial  laboratories  capable  of 
analyzing  drinking  water  for  chemical,  biological,  and  radiological  contaminants  resulting  from 
terrorist  attacks,  other  intentional  acts,  natural  disasters,  and  other  hazards.  The  Centers  for 
Disease  Control  and  Prevention  (CDC)  is  a  critical  partner  in  this  effort  given  the  potential 
leveraging  opportunities  with  CDC’s  existing  Laboratory  Response  Network  (LRN).  In  the  first 
step  towards  building  the  WLA,  the  EPA  and  its  partners  have  established  Regional  Laboratory 
Response  Plans  (RLRPs)  in  all  ten  EPA  Regions.  The  plans  provide  each  region  with  a 
structure  for  joint  response  by  laboratories  (consisting  of  EPA  regional  and  state  public 
health/environmental  laboratories  as  well  as  the  larger  drinking  water  utility  laboratories)  within 
the  region.  These  plans  will  be  consolidated  into  a  nationwide  response  plan  that  will  be  used  as 
the  foundation  of  the  WLA.  During  FY  2008,  each  plan  will  undergo  functional  exercises  using 
live  samples  to  test  the  effectiveness  of  each  plan,  to  enhance  coordination  among  member 
laboratories,  and  to  identify  additional  systems  and  mechanisms  needed  to  improve  sample 
transport,  data  transfer,  and  analytical  support  during  a  drinking  water  contamination  event. 
Figure  1  shows  the  status  of  the  functional  exercises  that  will  be  used  to  evaluate  and  optimize 
the  RLRPs. 


February  4 


cVRI 


Exercises  Scheduled 
1  |  Exercises  Completed 


Figure  1.  Status  of  Functional  Exercises  for  RLRP  as  of  June  2008 
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Active  and  Effective  Protective  Program 


To  further  support  protection  of  public  health  and  the  environment,  WSCC  and  GCC  members 
worked  with  EPA  to  update  the  features  of  an  active  and  effective  protective  program  (see 
discussion  under  Section  6  about  metrics  working  group).  The  Water  Sector  revised  the 
features  to  reflect  an  all-hazards  approach  as  well  as  to  align  them  with  the  SSP  goals  and 
objectives.  Many  utilities  will  be  able  to  adopt  some  of  the  features  with  minimal,  if  any,  capital 
investment.  EPA,  in  collaboration  with  its  sector  security  partners,  will  continue  the  ongoing 
promotion,  use,  and  adoption  of  these  features  within  the  Water  Sector. 

The  current  10  features  of  an  active  and  effective  security  program  for  Water  Sector  utilities  are 
as  follows: 

1 .  Encourage  awareness  and  integration  of  a  comprehensive  protective  posture  into  daily 
business  operations  to  foster  a  protective  culture  throughout  the  organization  and  ensure 
continuity  of  utility  services. 

2.  Annually  identify  protective  program  priorities  and  resources  needed;  support  priorities 
with  utility-specific  measures  and  self-assess  using  these  measures  to  understand  and 
document  program  progress. 

3.  Employ  protocols  for  detection  of  contamination  while  recognizing  limitations  in  current 
contaminant  detection,  monitoring,  and  public  health  surveillance  methods. 

4.  Assess  risks  and  periodically  review  (and  update)  vulnerability  assessments  to  reflect 
changes  in  potential  threats,  vulnerabilities,  and  consequences. 

5.  Establish  physical  and  procedural  controls  to  restrict  access  to  only  authorized 
individuals  and  to  detect  unauthorized  physical  and  cyber  intrusions. 

6.  Incorporate  protective  program  considerations  into  procurement,  repair,  maintenance, 
and  replacement  of  physical  infrastructure  decisions. 

7.  Prepare  emergency  response,  recovery,  and  business  continuity  plan(s);  test  and  review 
plan(s)  regularly,  update  plan(s)  as  necessary  to  ensure  NIMS  compliance  and  to  reflect 
changes  in  potential  threats,  vulnerabilities,  consequences,  physical  infrastructure,  utility 
operations,  critical  interdependencies,  and  response  protocols  in  partner  organizations. 

8.  Forge  reliable  and  collaborative  partnerships  with  first  responders,  managers  of  critical 
interdependent  infrastructure,  other  utilities,  and  response  organizations  to  maintain  a 
resilient  infrastructure. 

9.  Develop  and  implement  strategies  for  regular,  ongoing  communication  about  protective 
programs  with  employees,  customers,  and  the  general  public  to  increase  overall 
awareness  and  preparedness  for  response  to  an  incident. 

10.  Monitor  incidents  and  available  threat-level  information;  escalate  procedures  in  response 
to  relevant  threats  and  incidents. 
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Goal  2:  Recognize  and  Reduce  Risks  in  the  Water  Sector 

Risk  Assessment  Methodologies 

In  support  of  Goal  2,  EPA,  DHS,  and  its  security  partners  will  continue  to  encourage  and 
participate  in  the  conduct  of  risk  assessments  in  the  sector.  Drinking  water  and  wastewater 
utilities  performed  risk  assessments  based  on  several  methodologies  developed  by  sector 
security  partners.  Risk  assessment  tools  such  as  the  Risk  Assessment  Methodology  -  Water 
(RAM-W)  and  Vulnerability  Self-Assessment  Tool  (VSAT)  have  been  developed  to  facilitate 
utility  risk  assessments,  thereby  enabling  targeted  risk  reduction  efforts  across  the  sector.  The 
Security  and  Environmental  Management  System  (SEMS)  software  program  was  developed  by 
the  National  Rural  Water  Association  (NRWA)  and  is  based  on  a  self-assessment  guide  for 
drinking  water  systems  serving  populations  of  between  3,300  and  10,000. 

The  Water  Sector  is  currently  in  the  process  of  examining  these  existing  risk  assessment 
methodologies  relative  to  DHS’s  NIPP  baseline  criteria  for  risk  assessment  methodologies  (e.g., 
Risk  Analysis  and  Management  for  Critical  Asset  Protection  [RAMCAP]  process).  The  Sector  is 
developing  an  approach  to  effectively  make  RAMCAP-consistent  risk  assessment  tools 
operational  for  water  system  owners  and  operators.  The  recommendation  of  the  WSCC  is  that 
all  three  tools  (RAM-W,  VSAT  and  SEMS)  be  operationalized  under  the  RAMCAP  framework, 
as  described  in  Chapter  4  of  the  SSP,  to  expedite  the  integration  of  risk  assessment  processes 
as  defined  in  the  NIPP  and  advance  the  sector’s  progress  in  supporting  the  primary  objective  in 
Goal  2.  EPA  and  DHS  are  considering  the  WSCC’s  recommendation  to  develop  RAMCAP 
consistent,  automated  versions  of  all  three  tools  and  will  continue  to  work  with  the  WSCC  to 
enhance  the  risk  assessment  process  for  the  sector. 

The  WSCC  has  also  developed  the  following  Voluntary  Risk  Management  Framework  to  help 
prioritize  the  water  utility  evaluation.  This  approach  is  consistent  with  the  NIPP,  SSP,  other 
Sector  efforts  and  ongoing  efforts  to  enhance  the  security  posture  of  the  Sector.  The  Water 
Sector  is  very  diverse  in  type,  scope  and  scale  of  operations,  thus  risk  analysis  processes  must 
be  applied  consistently  and  equitably  across  the  sector  to  ensure  that  the  primary  risks  are  the 
first  to  be  treated  with  mitigation  controls. 

The  conduct  of  risk  assessments  in  the  sector  is  recommended  as  best  practice  and  is 
fundamental  to  the  Sector  Risk  Management  Performance  Metrics  effort  recently  concluded  by 
the  WSCC  and  the  GCC.  The  Water  Sector  should  utilize  both  qualified  and  quantified  risk 
assessment  processes  to  measure  risk  to  an  asset  or  system,  prioritize  investments  and  efforts 
to  mitigate  risk  and  to  track  risk  management  performance  vs.  investment  over  time.  Due  to  the 
diversity  in  scale  of  operations  in  the  sector,  qualified  risk  screening  should  be  conducted  to 
determine  the  appropriate  level  of  rigor  that  should  be  applied  to  an  assessment  thus  matching 
the  desired  detail  of  the  assessment  to  the  front-side  qualified  risk  screening.  The  application  of 
Tier  criteria  will  allow  a  utility  owner/operator  to  quickly  assess  the  qualified  risks  to  their  water 
system  and  determine  the  level  of  risk  assessment  to  conduct.  This  process  is  derived  from 
and  consistent  with  the  RAMCAP  top-level  screening  process.  The  Tier  framework  and  criteria 
below  represent  the  WSCC  RAMCAP  working  group's  recommendations. 

The  following  types  of  impact  potential,  as  recommended  by  the  WSCC,  should  be  taken  into 
consideration  when  conducting  risk  assessments:  Loss  of  life,  economic  impact,  psychological 
effect/continuity  of  government,  and  critical  customers.  These  impact  categories  were  assessed 
by  the  working  group  and  the  following  scenarios  were  found  to  be  the  minimum  set  that  should 
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be  considered  in  order  to  prioritize  risks  to  the  customers  and  communities  served  by  a  water 
system  as  well  as  the  regional  economy. 

Loss  of  Life 

•  Fatalities  resulting  from  product  contamination  or  the  release  of  hazardous  chemicals 
from  treatment  facilities 

Economic  Impact 

•  Direct  impact  to  the  utility  from  physical  damage  to  assets,  lost  revenue,  liability  and 
fines 

•  Indirect  impact  to  the  regional  economy  from  service  interruption 

Psychological  Effect  /  Continuity  of  Government 

•  Service  interruption  or  product  contamination  that  results  in  public  health  concerns  and 
first  responder  service  degradation  (fire  pressure)  to  the  extent  that  mass  evacuations 
are  likely  or  required 

Critical  Customers 

•  Prolonged  service  interruption  to  Tier  1  &2  assets  in  other  CIKR  sectors,  such  as  but  not 
limited  to  Health  Care  Sector  assets,  Critical  Commercial  Services  Sector  venues,  or 
National  Icons 

Table  3  shows  the  WSCC  proposed  tiers  for  the  voluntary  risk  management  framework.  These 
impact  categories  were  assessed  by  the  working  group  as  the  minimum  that  should  be 
considered  to  prioritize  risks  to  the  customers  and  communities  served  by  a  water  system  as 
well  as  the  regional  economy.  The  tier  is  determined  by  the  highest  single  criteria  threshold. 
EPA,  DPIS,  and  the  GCC  are  considering  the  WSCC’s  proposed  tiers  for  the  risk  management 
framework  and  will  continue  to  work  with  the  WSCC  on  this  issue. 


Table  3.  WSCC  Proposed  Tiers  for  Risk  Management  Framework 


Criterion 

Tier  1 

Tier  2 

Tier  3 

Tier  4 

Population  Served 
(retail  +  wholesale) 

>1  million 

25,000-999,999 

3,300-24,999 

<3,300 

On-site  Gaseous 
Chlorine  Storage 
(average  daily 
volume  stored) 

240  tons 

20-39  tons 

1-19  tons 

<1  ton 

Economic  Impact 
(regional  impact,  not 
including  value  of 
statistical  life) 

>$100  billion 

$5-$99.9  billion 

$100  million— $4.9  billion 

<$100  million 

Critical  Customers 
Served 

Federal 

Government 

Defined 

Federal 

Government 

Defined 

Two  or  more  of  the  following: 

•  Level  1  Trauma 

•  Venue  that  hold  1 0K + 

•  National  Icons 

•  Key  DoD  facilities 

•  Key  Defense  Industrial 
Base  (DIB)  asset 

Not  applicable 
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Cyber  Security  Roadmap 

The  Cyber  Security  Roadmap4  was  developed  by  the  Cyber  Security  Working  Group  of  the 
WSCC.  The  Roadmap  is  a  unified  security  strategy  to  mitigate  the  risks  associated  with  cyber 
systems.  It  provides  a  10-year  broad-based  plan  for  improving  security  preparedness, 
resilience,  and  response/recovery  of  industrial  control  systems.  The  plan  is  divided  into  goals, 
milestones,  and  activities  over  the  near  (0-1  year),  mid  (1-3  years),  and  long  term  (3-10  years). 
The  four  main  goals  are: 

1 .  Developing  and  deploying  control  system  security  programs 

2.  Assessing  risk 

3.  Developing  and  implementing  risk  mitigation  measures 

4.  Improving  partnership  and  outreach. 

In  support  of  attaining  these  goals,  the  Roadmap  lists  milestones.  Selected  near-term 
milestones  include:  isolating  control  systems  from  public  switched  networks  and  developing  a 
cyber  response  protocol  template.  Selected  mid-term  milestones  include:  developing  an 
operator  control  system  security  training  program  and  adopting  best  practices  for  cyber  security 
in  the  Water  Sector.  Selected  long-term  milestones  include:  integrating  the  Roadmap  with  the 
Water  SSP  and  establishing  life  cycle  investment  and  framework  for  cyber  security.  The 
Roadmap  has  also  prescribed  activities  necessary  to  attain  both  the  goals  and  milestones.  DHS 
and  Idaho  National  Laboratory  (INL),  in  2007,  completed  development  of  a  control  systems 
cyber  security  self-assessment  tool  (CS2SAT)  for  use  by  Water  Sector  utilities  in  collaboration 
with  the  Water  Environment  Research  Foundation  (WERF)  and  AWWA  Research  Foundation 
(AwwaRF).  Discussions  are  currently  under  way  to  integrate  the  use  of  the  above  tool  with  the 
national  recommended  Roadmap  implementation  efforts  to  maximize  the  impact  of  cyber 
security  self-awareness  among  the  utilities. 

Goal  3:  Maintain  a  Resilient  Infrastructure 


Water/Wastewater  Agency  Response  Networks 

The  Water  Sector’s  professional  associations,  State  primacy  agencies,  and  EPA  have  been 
promoting  a  more  resilient  Water  Sector.  One  approach  the  Water  Sector  has  taken  towards 
Water  Sector  resiliency  includes  the  establishment  of  mutual  aid  and  assistance  agreements 
between  utilities  under  the  Water/Wastewater  Agency  Response  Network  (WARN)  framework. 

A  WARN  is  a  network  of  “Utilities  Helping  Utilities”  respond  to  and  recover  from  emergencies. 
The  WARN  initiative  also  supports  a  key  priority  outlined  in  both  the  National  Incident 
Management  System  (NIMS)  and  the  National  Preparedness  Goal. 

The  purpose  of  a  WARN  is  to  provide  a  method  in  which  water/wastewater  utilities  that  have 
sustained  or  anticipate  damages  from  natural  or  manmade  incidents  can  receive  emergency  aid 
and  assistance  in  the  form  of  personnel,  equipment,  materials,  and  other  associated  services  as 
necessary  from  other  water/wastewater  utilities.  The  objective  is  to  provide  rapid,  short-term 


4  WSCC.  Roadmap  to  Secure  Control  Systems  in  the  Water  Sector.  Sponsored  by  AWWA  and  DHS. 
March  2008.  http://www.awwa.org/files/GovtPublicAffairs/PDF/WaterSecurityRoadmap031 908.pdf 
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deployment  of  emergency  services  to  restore  the  critical  operations  of  the  affected 
water/wastewater  utility.  The  backbone  of  the  WARN  concept  is  the  mutual  aid  and  assistance 
agreement  where  provisions  for  network  activation,  reimbursement,  liability  and  other  issues  are 
mutually  agreed  upon  by  participating  utilities.  Participation  is  voluntary;  there  is  no  obligation  to 
respond,  and  there  is  no  direct  cost  to  become  a  member  of  the  network.  WARNs  include  both 
public  and  private  drinking  water  and  wastewater  systems. 

The  WARN  framework  provides  a  forum  for  establishing  and  maintaining  emergency  contacts, 
providing  expedited  access  to  specialized  Water  Sector  resources  needed  to  respond  to  and 
recovery  from  emergencies  that  disrupt  water/wastewater  services,  and  facilitating  training  that 
specifically  focuses  on  the  exchange  of  resources  during  an  emergency.  Events  such  as  9/1 1 , 
the  1994  Northridge  earthquake,  the  1997  Red  River  flood,  and  more  recently,  Hurricanes 
Katrina  and  Rita,  identified  a  need  for  water  and  wastewater  utilities  to  create  intrastate  mutual 
aid  and  assistance  programs. 

The  tremendous  progress  of  this  initiative  is  shown  on  Figure  2  below.  While  it  does  receive 
support  nationwide,  the  initiative  owes  its  success  to  the  proactive,  bottom-up  ownership  of 
utilities  that  have  recognized  the  need  to  develop  additional  preparedness  capabilities  and  to 
help  ensure  the  overall  resiliency  of  the  communities  they  serve.  Currently,  utilities  in  29  states 
have  signed  agreements  that  follow  the  WARN  model  and  utilities  in  all  50  states  have  been 
provided  the  opportunity  to  participate  in  a  series  of  workshops  conducted  by  the  American 
Water  Works  Association  (AWWA)  under  a  grant  provided  by  EPA.  A  Web  site, 
http://www.NationalWARN.org,  has  been  established  to  share  information  on  WARN,  including 
the  current  status  of  each  program  and  contact  information  for  each  WARN  Chair. 


Agreement 

Signed 

Agreement 

Pending 

Steering 

Committee 

Leadership 

Team 

Workshop 

2006/07/08 


Figure  2.  Status  of  WARN  programs  as  of  June  20085 
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The  AWWA  published  a  Resource  Typing  Manual6  to  provide  guidance  to  water  and  wastewater 
utilities  when  they  request  and  provide  resources  during  an  emergency.  The  Resource  Typing 
Manual  follows  the  resource  typing  guidance  issued  by  FEMA  in  March  20077,  which  provides 
categorized,  capability  based  resource  descriptions  to  ensure  a  consistent  meaning  to  mutual 
aid  resource  requests. 

In  the  near  future,  the  Water  Sector  will: 

•  Continue  to  develop  WARN  outreach  materials  and  facilitate  meetings,  workshops, 
training  sessions,  conference  calls,  webcasts,  and  other  communications 

•  Continue  to  provide  administrative  and  technical  support  to  assist  in  formation  of  new 
WARNS 

•  Expand  the  online  repository  of  WARN  information  located  on  EPA  and  Water  Sector 
association  Web  sites 

•  Provide  an  analysis  of  the  economic  benefits  and  cost  savings  from  joining  a  WARN 

•  Develop  tabletop  exercise  materials  and  facilitate  tabletop  exercises 

•  Provide  information  on  how  to  develop  a  Mutual  Aid  and  Assistance  Operational  Plan, 
which  provides  more  detailed  information  than  the  initial  agreement  on  how  to  implement 
and  manage  the  WARN  program 

As  the  development  of  intrastate  mutual  aid  and  assistance  networks  expands,  the  Water 
Sector  will  continue  to  pursue  mechanisms  to  share  mutual  aid  and  assistance  across  state 
lines  if  local  and  statewide  mutual  aid  and  assistance  resources  are  overwhelmed.  Integration  of 
WARNs  with  interstate  mutual  aid  and  assistance  networks,  such  as  the  Emergency 
Management  Assistance  Compact  (EMAC),  will  be  evaluated.  In  collaboration  with  EMAC,  EPA 
published  the  EMAC  Tips  for  the  Water  Sector  fact  sheet,  which  provides  information  on  how 
the  Water  Sector  can  use  EMAC  for  interstate  mutual  aid  and  assistance.  Additional  analysis 
will  be  undertaken  to  determine  if  the  intrastate  WARN  agreements  can  be  modified  to  allow 
mutual  aid  and  assistance  to  be  provided  across  state  lines. 

Training  and  Exercises 

Also,  EPA  and  national  Water  Sector  associations  have  developed  tools  and  extensive  training 
programs  to  help  utilities  enhance  their  emergency  response  preparedness  and  communicate 
with  local  first-responders  and  public  health  providers  during  an  incident  response.  EPA  is 
providing  training  on  the  Incident  Command  System  (ICS)  and  NIMS,  which  will  enable 
personnel  to  operate  efficiently  during  an  incident  or  event  and  assist  the  Water  Sector  with 
NIMS  compliance.  ICS  and  NIMS  are  national  standards  used  across  the  country  for  emergency 
management  and  are  used  by  the  Water  Sector’s  first  response  partners.  An  owner/operator’s 


6  AWWA.  Water  and  Wastewater  Mutual  Aid  and  Assistance  Resource  Typing  Manual.  April  2008. 
http://www.awwa.org/files/WARN/AWWA%20Resource%20Typing%20Manual%20Final%20- 
%20April%202%2C%202008.pdf 

7  FEMA.  National  Resource  Typing  Criteria.  March  2007. 
http://www.fema.gov/pdf/emergency/nims/ng_0001  .pdf 
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ability  to  respond  and  coordinate  a  response  with  its  partners  will  be  greatly  enhanced  by  this 
training.  In  addition  to  the  ICS  and  NIMS  training,  EPA  also  is  providing  emergency  response 
training  to  wastewater  treatment  systems  and  their  community  partners.  The  Emergency 
Response  to  Threats  of  Contamination  of  Public  Wastewater  Systems  training  provides 
information  and  procedures  to  guide  wastewater  treatment  systems  when  responding  to  a 
contamination  incident  or  threat.  It  addresses  who  to  notify,  what  actions  to  take,  how  to 
evaluate  a  threat,  how  to  collect  and  analyze  samples,  how  to  communicate  with  the  public  and 
how  to  recover  from  an  incident.  The  training  is  being  held  nationwide  and  will  be  followed  by 
the  release  of  a  companion  guidance  document,  The  Wastewater  Response  Protocol  Toolbox - 
Planning  for  and  Responding  to  Wastewater  Contamination  Incidents  and  Threats. 

EPA,  states,  and  national  Water  Sector  associations  continue  to  conduct  tabletop  exercises 
using  EPA’s  Emergency  Response  Tabletop  Exercises  for  Drinking  Water  and  Wastewater 
Systems  CD-ROM  that  was  published  in  2005.  During  FY08,  this  training  tool  will  be  updated  to 
include  additional  scenarios  and  to  make  the  materials  compliant  with  DHS’s  Homeland  Security 
Exercise  and  Evaluation  Program  (HSEEP).  These  exercises  bring  together  first  response 
partners  in  order  to  practice  plans  and  procedures  including  how  utilities  will  communicate  and 
coordinate  with  their  first  response  partners. 

National  Response  Framework 

EPA,  states,  and  national  Water  Sector  associations  provided  comments  and  participated  in 
workgroups  as  part  of  DHS’s  efforts  to  update  the  National  Response  Plan  (NRP),  now  called 
the  National  Response  Framework  (NRF),  and  NIMS.  Within  the  NRF,  EPA  has  significant 
support  agency  Water  Sector  roles  and  responsibilities  under  Emergency  Support  Function  #3 
(ESF#3)  and  the  Critical  Infrastructure  and  Key  Resource  Annex.  To  better  coordinate  its 
activities  under  ESF#3,  the  Agency  has  worked  and  will  continue  to  work  closely  with  the  U.S. 
Army  Corps  of  Engineers  and  FEMA  to  better  define  each  agency’s  responsibilities  and  develop 
procedures  and  mechanisms  for  activating  and  deploying  EPA  responders.  To  further  enhance 
EPA’s  capability  to  respond  to  water  related  incidents,  the  Agency  is  also  is  conducting  water 
emergency  response  training  in  FY08  for  EPA’s  On-Scene  Coordinators,  Criminal  Investigation 
and  Homeland  Security  Special  Agents,  and  regional  water  team  personnel.  The  Agency  also 
participates  in  national  emergency  response  exercises  in  coordination  with  EPA,  Federal,  State, 
local,  WARN,  and  WaterlSAC  partners. 

Business  Continuity  with  the  Water  Sector 

An  additional  component  of  maintaining  a  resilient  infrastructure  is  having  a  business  continuity 
plan  (BCP)  in  place.  BCP  is  a  risk  management  strategy  or  methodology  that  includes  a  variety 
of  utility  operations  plans  that  may  be  specifically  tailored  to  certain  operating  condition,  but 
collectively  define  or  characterize  how  a  utility  will  continue  critical  business  functions  during 
and  after  various  incidents.  Business  continuity  planning  provides  the  basis  for  resiliency  of  a 
utility’s  essential  functions  and  critical  resources,  including  key  personnel  and  financial 
resources  as  well  as  the  flexibility  to  adapt  human  resources  policies  to  meet  the  changing 
needs  of  employees.  The  AWWA  currently  is  in  the  process  of  providing  updated  guidance  on 
the  development  of  business  continuity  plans  for  the  Water  Sector  and  is  sponsoring  two-day 
seminars  in  a  series  of  modules  that  presents  a  step-by-step  approach  to  developing  the  core 
elements  of  a  BCP  for  a  utility.  In  addition,  as  a  standards  development  organization,  AWWA  is 
currently  in  the  process  of  drafting  an  Emergency  Preparedness  Standard  for  the  Water  Sector 
in  the  context  of  National  Fire  Protection  Association  (NFPA  1600)  relative  to  the  specific 
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operational  needs  of  the  Water  Sector.  This  standard  is  being  developed  under  the  American 
National  Standards  Institute  (ANSI)  procedures  for  voluntary  consensus-based  standards. 

Interdependencies 

The  Water  Environment  Federation  (WEF),  under  a  cooperative  agreement  with  DFIS’  Federal 
Emergency  Management  Agency  (FEMA),  is  providing  a  cross-sector  emergency  response 
training  program  for  Water  Sector  utilities.  The  primary  objective  of  this  training  is  to  assist 
Water  Sector  utilities  in  building  sustained,  resilient  local  and  regional  partnerships  across  other 
CIKR  sectors.  These  partnerships  will  align  closely  with  the  National  Preparedness  Framework 
and  with  other  federal,  state,  and  local  guidelines  in  an  effort  to  provide  a  comprehensive, 
consistent  response  to  all  hazards  and  reduce  impacts  and  recovery  times. 

The  data  substantiating  the  need  to  address  Water  Sector  interdependencies  is  noteworthy  as 
approximately  54,000  publicly  owned  community  water  systems  (CWS)  and  16,000  publicly 
owned  treatment  works  (POTWs)  (Water  Sector  utilities)  provide  critical  services  to 
communities,  including  ensuring  a  safe  potable  water  supply  and  the  availability  of  water 
resources  that  can  support  recreation,  fishing,  and  agriculture.  Additionally  these  utilities  provide 
services  essential  to  other  sectors  during  emergency  response  efforts,  including  providing  an 
adequate  water  supply  for  fire  protection  as  well  as  services  essential  to  the  recovery  of  areas 
impacted  by  natural  disasters  or  terrorist  events. 

While  the  Water  Sector  has  made  significant  improvements  in  the  area  of  security  and 
emergency  response  prior  to,  and  particularly  since,  the  events  of  September  1 1 , 2001 ,  many 
utilities  still  lack  coherent  local  and  regional  partnerships  across  multiple  sectors  in  order  to 
prepare  for,  and  effectively  respond  to,  manmade  threats  and  natural  disasters.  Building  on 
accomplishments  from  both  inside  and  outside  the  Water  Sector,  this  training  program  will 
leverage  expertise  from  and  provide  information  to  Water  Sector  utility  executives,  as  well  as 
key  leaders  in  other  sectors,  on  existing  resources  related  to  Water  Sector  interdependencies. 
Course  materials  for  the  national  cross-sector  training  series  will  include  a  brief  overview  of  the 
critical  infrastructures  interdependencies  with  the  Water  Sector,  as  well  as  a  tabletop  exercise 
that  will  highlight  Water  Sector  interdependencies. 

Recently,  EPA  and  the  Chicago  Manufacturing  Center’s  Great  Lakes  Partnership  Program 
launched  the  Chicagoland  Water  and  Wastewater  Preparedness  and  Business  Resiliency  Pilot, 
which  focused  on  understanding  the  interdependencies  of  critical  infrastructures  and  how  an 
interruption  in  the  Water  Sector  would  impact  business  resiliency  and  the  economic  viability  of 
the  broader  community. 

Pandemic  Planning 

EPA  will  assist  DHS  in  planning  a  Sector-Specific  Pandemic  Influenza  Workshop  in  2008.  EPA 
will  also  support  the  Department  of  Health  and  Human  Services  by  providing  Water  Sector  input 
on  pandemic  vaccine  and  antiviral  prioritization  guidance.  EPA  will  continue  to  support  these 
and  other  efforts  to  prepare  and  assist  the  nation’s  drinking  water  and  wastewater  systems  in 
maintaining  operations  in  the  event  of  an  avian  or  pandemic  influenza  outbreak. 

Decontamination  Strategy 

The  Water  Sector  is  in  the  process  of  developing  a  strategy  to  guide  future  decontamination 
activities  for  the  sector.  The  Water  Sector  established  a  Critical  Infrastructure  Protection 
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Advisory  Council  (CIPAC)  Water  Sector  Decontamination  Working  Group  to  develop  a  3-5-year 
decontamination  strategy.  The  strategy  responds  to  the  Water  Sector’s  needs  for  information, 
tools,  and  resources  enabling  the  timely  recovery  and  “return  to  service”  of  utility  operations 
from  all  hazards  contamination  incidents  and  supporting  other  decontamination-related  issues.  It 
will  address  a  range  of  contamination  scenarios  related  to  the  type  of  system  (drinking  water, 
wastewater),  type  of  contaminant  (chemical,  biological,  radiological),  type  of  media  (including 
water,  infrastructure  and  equipment  used  to  store  and  treat,  distribution  and  collection  systems, 
household  plumbing,  and  environmental  media),  type  of  incident  (natural  or  manmade, 
accidental  or  intentional),  and  extent  of  contamination  (concentrations,  spatial  and  temporal 
variations).  Expected  to  be  completed  in  the  summer  of  2008,  the  strategy  will  also  help  meet 
requirements  for  EPA  under  HSPD-10,  which  charges  EPA  with  developing  strategies, 
guidelines,  and  plans  for  decontamination. 

Goal  4:  Increase  Communication.  Outreach,  and  Public  Confidence 

NIPP  Partnership  Model 

In  support  of  Goal  4,  EPA  and  its  Water  Sector  security  partners  are  committed  to  implementing 
the  NIPP  Partnership  Model.  The  WSCC  and  GCC,  established  under  this  model,  were 
established  in  2004  and  2005,  respectively.  The  WSCC  and  GCC  meet  three  to  four  times  per 
year  to  engage  in  information  sharing  and  address  an  array  of  communication  and 
programmatic  issues. 

WaterlSAC 

WaterlSAC  is  the  Water  Sector’s  Information  Sharing  and  Analysis  Center.  Designed  for 
utilities,  by  utilities,  WaterlSAC  is  an  effective  information  sharing  mechanism  that  serves  as  a 
liaison  between  the  sector’s  public  and  private  security  partners,  WaterlSAC  provides  America’s 
drinking  water  and  wastewater  utilities  with  secure  risk,  threat,  and  security  information  on  all¬ 
hazard  incidents  and  events,  including  physical  attacks,  contamination,  cyber  threats,  and 
natural  disasters.  Managed  by  the  Association  of  Metropolitan  Water  Agencies  (AMWA),  the 
WaterlSAC  is  an  independent  entity  able  to  secure  data  from  unauthorized  disclosure. 
WaterlSAC  is  funded  in  part  through  an  EPA  grant  and  subscriber  fees. 
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Update  to  Section  6  -  Measure  Progress 

6.1  CIKR  Performance  Measurement 

To  further  support  protection  of  public  health  and  the  environment,  the  WSCC  and  the  GCC, 
chaired  by  EPA,  formed  a  joint  CIPAC  Metrics  Workgroup  to  develop  sector-specific  security 
and  preparedness  metrics.  The  metrics,  which  are  voluntary,  are  based  on  the  NIPP  and  the 
Water  SSP  and  designed  to  help  evaluate  progress  made  towards  the  goals  and  objectives  set 
forth  by  the  sector. 

As  part  of  their  final  report,  the  CIPAC  Metrics  Workgroup  recommended  to  the  WSCC  that  the 
voluntary  national  measures  for  utilities  should  be  collected  by  a  third  party  (i.e.,  other  than  EPA 
or  DHS).  The  WSCC  identified  the  WaterlSAC  as  the  preferred  third  party  for  the  secure 
collection  and  aggregation  of  utility  measures  data. 

WaterlSAC  will  be  developing  a  reporting  tool  that  includes  a  series  of  questions  for  utilities  that 
correspond  to  the  national  measures.  The  main  access  portal  to  the  reporting  questions  will  be 
located  on  the  WaterlSAC  Web  site.  Data  will  be  collected  from  utilities  and  stored  in  a  secure 
database.  A  PIN  code  system  will  be  used  to  protect  utility  identity,  but  allow  for  quality  control 
of  the  data  submitted. 

The  Workgroup  recommendations  prescribed  focusing  initial  data  collection  on  a  subset  of 
“core”  metrics,  with  the  remaining  measures  proposed  for  optional,  utility  self-assessment 
purposes.  The  self-assessment  measures  will  be  available  for  utility  internal  use  through  the 
WaterlSAC,  but  will  not  be  connected  to  national  reporting. 

The  reporting  tool  will  also  use  a  series  of  data  aggregation  protocols,  governing  how  the 
collected  data  may  be  aggregated  and  reported  nationally  to  other  interested  parties,  including 
EPA  and  DHS.  The  data  aggregation  protocols  will  be  designed  to  ensure  that  the  identity  of 
individual  utilities  cannot  be  revealed  through  the  combination  of  data  (such  as  by  combining 
utility  size  and  state  locator  data). 

As  a  benefit  for  utilities  who  voluntarily  report  on  the  core  measures,  the  Workgroup  proposed 
that  utility  participants  who  submit  data  be  automatically  enrolled  in  the  basic  WaterlSAC 
service.  The  Workgroup  believed  this  benefit  will  be  a  valuable  incentive  to  improve  participation 
rates.  This  benefit  would  be  renewed  annually  for  participants  in  subsequent  reporting  cycles. 

Initial  outreach  will  focus  on  acquiring  data  from  small,  medium,  and  large  size  systems. 
WaterlSAC  will  promote  the  survey  questions  to  utilities  in  conjunction  with  other  Water  Sector 
associations,  such  as  AMWA,  AWWA,  NACWA,  NRWA,  and  WEF. 

Initial  data  collection  will  take  place  in  2008,  with  a  report  on  the  data  available  by  no  later  than 
the  end  of  the  year. 
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List  of  Acronyms 


AMWA 

ANSI 

AWWA 

BCP 

CDC 

CIKR 

CIPAC 

CS2SAT 

CWS 

DHS 

EMAC 

ESF 

EPA 

FEMA 

FY 

GCC 

HSEEP 

HSPD 

ICS 

INL 

NACWA 

LRN 

NFPA 

NIMS 

NRF 

NRP 

NRWA 

PIN 

POTW 

RAMCAP 

RAM-W 

RLRP 

SEMS 

SSP 

NIPP 

VSAT 

WARN 

WaterlSAC 

WEF 

WSCC 

WSI 

Association  of  Metropolitan  Water  Agencies 

American  National  Standards  Institute 

American  Water  Works  Association 

Business  Continuity  Plan 

U.S.  Centers  for  Disease  Control  and  Prevention 

Critical  Infrastructure  and  Key  Resources 

Critical  Infrastructure  Partnership  Advisory  Council 

Control  Systems  Cyber  Security  Self-Assessment  Tool 
Community  Water  System 

U.S.  Department  of  Plomeland  Security 

Emergency  Management  Assistance  Compact 

Emergency  Support  Function 

U.S.  Environmental  Protection  Agency 

Federal  Emergency  Management  Agency 

Fiscal  Year 

Government  Coordinating  Council 

Homeland  Security  Exercise  and  Evaluation  Program 
Homeland  Security  Presidential  Directive 

Incident  Command  System 

Idaho  National  Laboratory 

National  Association  of  Clean  Water  Agencies 

Laboratory  Response  Network 

National  Fire  Protection  Association 

National  Incident  Management  System 

National  Response  Framework 

National  Response  Plan 

National  Rural  Water  Association 

Personal  Identification  Number 

Publicly  Owned  Treatment  Works 

Risk  Analysis  and  Management  for  Critical  Asset  Protection 
Risk  Assessment  Methodology  -  Water 

Regional  Laboratory  Response  Plan 

Security  and  Environmental  Management  System 
Sector-Specific  Plan 

National  Infrastructure  Protection  Plan 

Vulnerability  Self-Assessment  Tool 

Water/Wastewater  Agency  Response  Network 

Water  Information  Sharing  and  Analysis  Center 

Water  Environment  Federation 

Water  Sector  Coordinating  Council 

Water  Security  Initiative 
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